2019-06-03 22:21:06, Info CSI 00002893 [SR] Verify complete Using Roguekiller before contacting Bleeping computer, performance improved to 9.6MBps, including a bit faster access times after booting. Sunil Saale, Head of Cyber and Information Security, Minter Ellison. 2019-06-03 22:19:19, Info CSI 0000225c [SR] Verify complete 2019-06-03 22:16:29, Info CSI 0000188b [SR] Verify complete 2019-06-03 22:18:11, Info CSI 00001e22 [SR] Verifying 100 components 2019-06-03 22:19:12, Info CSI 000021ee [SR] Beginning Verify and Repair transaction 2019-06-03 22:25:50, Info CSI 00003c63 [SR] Verifying 100 components 2019-06-03 22:23:26, Info CSI 000031ee [SR] Verifying 100 components 2019-06-03 22:20:05, Info CSI 0000255d [SR] Verify complete 2019-06-03 22:11:52, Info CSI 00000957 [SR] Beginning Verify and Repair transaction 2019-06-03 22:10:26, Info CSI 000004e2 [SR] Verify complete Secure Works immediately acknowledged the bug and agreed to a 90-day target fix, and requested a delay in publication until customers could update. Secureworks adds more layers of security to our business by quickly detecting threats and combating them effectively in real time. 2019-06-03 22:25:50, Info CSI 00003c64 [SR] Beginning Verify and Repair transaction 2019-06-03 22:18:54, Info CSI 000020b0 [SR] Beginning Verify and Repair transaction 2019-06-03 22:24:12, Info CSI 000035a6 [SR] Verifying 100 components 2019-06-03 22:15:07, Info CSI 00001345 [SR] Beginning Verify and Repair transaction 2019-06-03 22:24:12, Info CSI 000035a5 [SR] Verify complete PeerSpot users give Secureworks Taegis ManagedXDR an average rating of 7.6 out of 10. 2019-06-03 22:25:50, Info CSI 00003c62 [SR] Verify complete 2019-06-03 22:10:15, Info CSI 00000411 [SR] Verifying 100 components 2019-06-03 22:10:45, Info CSI 00000683 [SR] Verifying 100 components cpu: 800m 2019-06-03 22:12:02, Info CSI 00000a24 [SR] Verifying 100 components 2019-06-03 22:25:20, Info CSI 00003a47 [SR] Beginning Verify and Repair transaction Also, please check if there is backup software or antivirus scan which runs on the system when the issue reoccurs. Alternatives? 2019-06-03 22:10:26, Info CSI 000004e4 [SR] Beginning Verify and Repair transaction Lulus Lavender Floral Dress, Nature's Way Garden Veggies, Purses On Sale Near Malaysia, Photo Graduation Thank You Cards, Skechers Joggers Ladies, Defender Sweet Itch Combo, Good Vibes Only Neon Sign Purple, 2012 Nissan Altima Oil Filter Wix, Does R6 Have Quickshifter, 2002 Honda Accord Glove Box Removal, This article covers the system requirements for installing the Secureworks Red Cloak Endpoint agent. . Not as ideal as 25-36mps as before, but better than 3Mbps. 2019-06-03 22:24:23, Info CSI 00003676 [SR] Verifying 100 components 2019-06-03 22:14:41, Info CSI 00001187 [SR] Beginning Verify and Repair transaction 2019-06-03 22:21:13, Info CSI 00002900 [SR] Verify complete 2019-06-03 22:25:43, Info CSI 00003bf2 [SR] Verify complete press@secureworks.com 2019-05-31 08:59:22, Info CSI 00000007 [SR] Beginning Verify and Repair transaction 2019-06-03 22:10:15, Info CSI 00000412 [SR] Beginning Verify and Repair transaction 2019-06-03 22:18:34, Info CSI 00001f66 [SR] Verify complete The Secureworks Red Cloak Endpoint Agent collects a rich set of endpoint telemetry that is analyzed to identify threats and their associated behaviors in your environment. Agent 2.0.7.9 was released October 29th, in advance of the industry-accepted 90 day window. 2019-06-03 22:21:13, Info CSI 00002901 [SR] Verifying 100 components 2019-06-03 22:20:35, Info CSI 000026dc [SR] Verify complete This agent version also allowed logging level changes without restarting. 2019-06-03 22:21:23, Info CSI 00002970 [SR] Verify complete 2019-06-03 22:17:00, Info CSI 00001a5c [SR] Beginning Verify and Repair transaction 2019-06-03 22:22:27, Info CSI 00002d68 [SR] Verify complete After SFC is completed, copy and paste the content of the below code box into the command prompt. Thanks. ), HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\90114426.sys => ""="Driver", ==================== Association (Whitelisted) ===============, (If an entry is included in the fixlist, the registry item will be restored to default or removed. 2019-06-03 22:23:21, Info CSI 00003188 [SR] Beginning Verify and Repair transaction 2019-06-03 22:09:41, Info CSI 000001a3 [SR] Beginning Verify and Repair transaction 2019-06-03 22:24:56, Info CSI 0000388b [SR] Verify complete 2019-06-03 22:28:12, Info CSI 00004585 [SR] Beginning Verify and Repair transaction 2019-06-03 22:12:28, Info CSI 00000b7c [SR] Verify complete Can we test the wireless driver? If you have any feedback regarding its quality, please let us know using the form at the bottom of this page. Sorry for the slower responses, as this is my Mom's machine. Any interaction we have with a human there has been terrible. 2019-06-03 22:26:17, Info CSI 00003e07 [SR] Verify complete 2019-06-03 22:26:59, Info CSI 000040e9 [SR] Verify complete I've run a Malwarebytes scan and a full virus scan with Microsoft Security Essentials: nothing found. I do agree with the Secure Works stance that because local access is required, the potential for exploit is low. 2019-06-03 22:24:50, Info CSI 00003824 [SR] Verify complete 2019-06-03 22:12:14, Info CSI 00000a9e [SR] Verifying 100 components Click on. The CPU is being used for the cleanup of Integrity Monitoring baselines. Its pretty invasive for a personal laptop lol. 2019-06-03 22:20:25, Info CSI 0000266c [SR] Beginning Verify and Repair transaction 2019-06-03 22:19:44, Info CSI 0000240e [SR] Verifying 100 components 2019-06-03 22:21:54, Info CSI 00002b8f [SR] Beginning Verify and Repair transaction 2019-06-03 22:25:37, Info CSI 00003b8c [SR] Verifying 100 components I'm going to limp along by restarting the computer when it gets slow (shades of Windows 95) and get a new computer when Win 10 comes out. 2019-06-03 22:14:16, Info CSI 00000fc3 [SR] Verify complete Check the items to isolate and troubleshoot the issue of high CPU usage on a Deep Security Agent machine. If I shut down all applications before the CPU gets totally consumed then the demand of the little services will slowly return to normal (30-60 minutes). 2019-06-03 22:19:50, Info CSI 00002479 [SR] Verifying 100 components Running in Safe Mode eliminated the loss of download speed so I knew it wasn't a problem with hardware or my cable modem or wireless router. 2019-06-03 22:24:06, Info CSI 00003535 [SR] Verify complete 2019-06-03 22:25:20, Info CSI 00003a45 [SR] Verify complete 2019-06-03 22:26:44, Info CSI 00004004 [SR] Beginning Verify and Repair transaction Built on proprietary technologies and world-class threat intelligence, our applications and solutions help prevent, detect, and respond to cyber threats. 2019-06-03 22:14:55, Info CSI 0000126b [SR] Verify complete 2019-06-03 22:19:19, Info CSI 0000225d [SR] Verifying 100 components We have cisco AMP AV separately (which we like) but bonus if we can combine it all in to one vendor. 2019-06-03 22:13:07, Info CSI 00000d45 [SR] Verifying 100 components At the time of discovery, my (then) employer was using a suite of SecureWorks services, with a product called Red Cloak being a core component. Fix result of Farbar Recovery Scan Tool (x64) Version: 01-06-2019. Sometimes it is WORD or Outlook or Excel. Secureworks (NASDAQ: SCWX) is a global cybersecurity leader that protects customer progress with Secureworks Taegis, a cloud-native security analytics platform built on 20+ years of real-world threat intelligence and research, improving customers' ability to detect advanced threats, streamline and collaborate on investigations, and . There does seem to be a dependence on which web sites I'm connected to w/IE 11 but even that is not reproducible. requests: 2019-06-03 22:27:52, Info CSI 0000441f [SR] Verifying 100 components 2019-06-03 22:12:39, Info CSI 00000bef [SR] Verifying 100 components 2019-06-03 22:17:40, Info CSI 00001c93 [SR] Verifying 100 components 2019-06-03 22:23:05, Info CSI 0000304c [SR] Verifying 100 components 2019-06-03 22:23:38, Info CSI 000032c0 [SR] Verifying 100 components Above shows the error that happened when I had removed all permissions except for my own user account. Any forward-looking statement speaks only as of the date as of which such statement is made, and, except as required by law, we undertake no obligation to update any forward-looking statement after the date as of which such statement was made, whether to reflect changes in circumstances or our expectations, the occurrence of unanticipated events, or otherwise. Which is still better than constant. Creating the log file in the folder structure failed because the system account Red Cloak was using couldnt write to that folder. Navigate to the Red Cloak folder location from Windows Explorer: C:\Program Files (x86)\Dell SecureWorks\Red Cloak. I opened a support ticket to review and we started looking at various log files. 2019-06-03 22:21:30, Info CSI 000029e2 [SR] Verifying 100 components 2019-06-03 22:28:00, Info CSI 000044b6 [SR] Verifying 100 components 2019-06-03 22:19:31, Info CSI 00002336 [SR] Beginning Verify and Repair transaction 2019-06-03 22:24:18, Info CSI 0000360e [SR] Beginning Verify and Repair transaction 2019-06-03 22:28:39, Info CSI 00004790 [SR] Verifying 60 components I've spent several weeks trying to figure this out with all sorts of solutions implemented and none having any effect. 2019-06-03 22:16:38, Info CSI 00001902 [SR] Verifying 100 components We understand complex security environments and are passionate about simplifying security with Defense in Concert so that security becomes a business enabler. Make sure that it is the latest version. 2019-06-03 22:14:55, Info CSI 0000126c [SR] Verifying 100 components 2019-06-03 22:24:23, Info CSI 00003675 [SR] Verify complete 2019-06-03 22:20:50, Info CSI 000027b7 [SR] Verifying 100 components . 2019-05-31 08:59:28, Info CSI 00000014 [SR] Beginning Verify and Repair transaction 2019-06-03 22:26:44, Info CSI 00004002 [SR] Verify complete Use Secureworks' resource center to find authoritative security information from researchers, analysts, experts and real-world clients. ), (If an entry is included in the fixlist, it will be removed from the registry. 2019-06-03 22:16:02, Info CSI 00001650 [SR] Beginning Verify and Repair transaction 2019-06-03 22:27:06, Info CSI 0000415c [SR] Verify complete 2019-06-03 22:13:07, Info CSI 00000d44 [SR] Verify complete Disabling it reduced internet , but improved the Disk usage and cpu greatly. 2019-06-03 22:11:42, Info CSI 00000888 [SR] Verifying 100 components July 5th, 2018. 2019-06-03 22:25:33, Info CSI 00003b24 [SR] Verify complete 2019-06-03 22:27:44, Info CSI 000043a0 [SR] Beginning Verify and Repair transaction FirewallRules: [{95F772B1-0AB0-4172-9672-0D8D31ABD905}] => (Allow) C:\Program Files\CCleaner\CCUpdate.exe (Piriform Software Ltd -> Piriform Software Ltd), ==================== Restore Points =========================, ==================== Faulty Device Manager Devices =============, Application Path: C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe, Report Id: 009dcebb-d3f7-48fd-a8e8-5fe7f30f0294, Faulting package full name: Microsoft.LockApp_10.0.17763.1_neutral__cw5n1h2txyewy, Faulting package-relative application ID: WindowsDefaultLockScreen, Error: (03/20/2019 08:49:37 AM) (Source: Application Hang) (EventID: 1002) (User: ), Report Id: 9c70a34f-dbb3-42d3-ad67-42ab800351df, Error: (02/27/2019 12:19:59 PM) (Source: Application Hang) (EventID: 1002) (User: ), Report Id: 1da64374-4712-4099-8c90-17633e62d96d, Error: (12/28/2018 08:09:10 PM) (Source: Microsoft-Windows-WMI) (EventID: 24) (User: NT AUTHORITY), Error: (04/02/2019 11:58:10 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), Error: (04/02/2019 11:56:38 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), Error: (04/02/2019 11:56:37 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), Error: (03/20/2019 05:42:52 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), Error: (03/20/2019 05:41:02 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY), ==================== Memory info ===========================, ==================== Drives ================================, Drive c: () (Fixed) (Total:930.07 GB) (Free:893.03 GB) NTFS, \\?\Volume{c0eb0321-e386-4eb6-af69-4d63c700a79d}\ (WINRETOOLS) (Fixed) (Total:0.83 GB) (Free:0.44 GB) NTFS, ==================== MBR & Partition Table ==================, ========================================================, ==================== End of Addition.txt ============================, Deleted HKCU\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\dotomi.com, ***** [ Chromium (and derivatives) ] *****, ***** [ Firefox (and derivatives) ] *****, AdwCleaner[S00].txt - [3024 octets] - [30/05/2019 22:53:46], ########## EOF - C:\AdwCleaner\Logs\AdwCleaner[C00].txt ##########. 2019-06-03 22:23:42, Info CSI 0000332a [SR] Beginning Verify and Repair transaction 2019-06-03 22:17:58, Info CSI 00001d4a [SR] Verify complete 2019-06-03 22:25:03, Info CSI 00003909 [SR] Verify complete 2019-06-03 22:24:44, Info CSI 000037bf [SR] Beginning Verify and Repair transaction 2019-06-03 22:17:13, Info CSI 00001b3c [SR] Verify complete : r/sysadmin. The problem is explained like this I've ran both AVG and Malwarebytes and they've . 2019-06-03 22:18:11, Info CSI 00001e21 [SR] Verify complete 2019-06-03 22:09:36, Info CSI 0000013c [SR] Beginning Verify and Repair transaction 2019-06-03 22:22:57, Info CSI 00002f7f [SR] Beginning Verify and Repair transaction . 2019-06-03 22:21:54, Info CSI 00002b8d [SR] Verify complete 2019-06-03 22:10:01, Info CSI 0000033e [SR] Verify complete 2019-06-03 22:17:40, Info CSI 00001c94 [SR] Beginning Verify and Repair transaction 2019-06-03 22:18:48, Info CSI 00002046 [SR] Beginning Verify and Repair transaction Secureworks: Cybersecurity Leader, Proven Threat Defense | Secureworks A restart always fixed the problem. 2019-06-03 22:18:48, Info CSI 00002044 [SR] Verify complete Media State . 2019-06-03 22:26:03, Info CSI 00003d36 [SR] Beginning Verify and Repair transaction 2019-06-03 22:19:04, Info CSI 0000212c [SR] Beginning Verify and Repair transaction Knowledge gained from more than 1,000 incident response engagements per year informs the continuously updated threat intelligence and analytics used to recognize malicious activity. 2019-06-03 22:09:31, Info CSI 000000d3 [SR] Verify complete 2019-06-03 22:27:32, Info CSI 0000430d [SR] Verifying 100 components 2019-06-03 22:28:18, Info CSI 000045ec [SR] Beginning Verify and Repair transaction In the MSConfig Startup, click on, Select the restore point you created earlier and click. 2019-06-03 22:21:30, Info CSI 000029e1 [SR] Verify complete Simply put, what the hell is going on? . 2019-06-03 22:23:47, Info CSI 0000339a [SR] Beginning Verify and Repair transaction 2019-06-03 22:23:47, Info CSI 00003398 [SR] Verify complete ESET will now begin scanning your computer. 2019-06-03 22:18:41, Info CSI 00001fd1 [SR] Verify complete For more information about specific system requirements, click the appropriate operating system. We have been really unhappy with their responses and in general any guidance on security . memory: 768Mi. Secureworks Red Cloak Threat Detection and Response (TDR) - Adapters | Axonius. OP didn't seem that technical. 202-744-9767, Visit secureworks.com 2019-06-03 22:15:48, Info CSI 00001591 [SR] Verifying 100 components The file which is running by the task will not be moved. 2019-06-03 22:10:07, Info CSI 000003a6 [SR] Verify complete Running additional tools on your system can interfere with the clean-up process, or cause issues such as false positives. : DESKTOP-4SIK181, Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [54784] (Microsoft Corporation), ========================= Event log errors: ===============================, Error: (06/01/2019 05:14:14 PM) (Source: VSS) (User: ), Error: (05/24/2019 08:32:34 AM) (Source: Application Error) (User: ), Error: (05/24/2019 08:21:14 AM) (Source: Application Hang) (User: ), Error: (03/20/2019 08:49:37 AM) (Source: Application Hang) (User: ), Error: (02/27/2019 12:19:59 PM) (Source: Application Hang) (User: ), Error: (12/28/2018 08:09:10 PM) (Source: Microsoft-Windows-WMI) (User: NT AUTHORITY), Error: (06/02/2019 11:09:13 PM) (Source: DCOM) (User: NT AUTHORITY), Error: (06/01/2019 05:26:54 PM) (Source: DCOM) (User: DESKTOP-4SIK181), Error: (06/01/2019 05:20:06 PM) (Source: DCOM) (User: DESKTOP-4SIK181), Error: (06/01/2019 05:18:28 PM) (Source: DCOM) (User: NT AUTHORITY), Error: (06/01/2019 05:17:37 PM) (Source: DCOM) (User: DESKTOP-4SIK181), Error: (06/01/2019 05:14:14 PM) (Source: VSS)(User: ), Error: (05/24/2019 08:32:34 AM) (Source: Application Error)(User: ), Error: (05/24/2019 08:21:14 AM) (Source: Application Hang)(User: ), Error: (03/20/2019 08:49:37 AM) (Source: Application Hang)(User: ), Error: (02/27/2019 12:19:59 PM) (Source: Application Hang)(User: ), Error: (12/28/2018 08:09:10 PM) (Source: Microsoft-Windows-WMI)(User: NT AUTHORITY), Intel Processor Graphics (HKLM-x32\\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 20.19.15.4835 - Intel Corporation), ========================= Devices: ================================, Name: Microsoft ACPI-Compliant Embedded Controller, Name: Intel Serial IO I2C Host Controller - 9C62, Name: Microsoft ACPI-Compliant Control Method Battery, Name: Intel Core i5-4210U CPU @ 1.70GHz, Name: Microsoft Windows Management Interface for ACPI, Name: Intel 8 Series PCI Express Root Port #3 - 9C14, Name: Microsoft Hyper-V Virtualization Infrastructure Driver, Name: Intel 8 Series LPC Controller (Premium SKU) - 9C43, Name: Microsoft Storage Spaces Controller, Name: Microsoft Kernel Debug Network Adapter, Name: Intel 8 Series USB Enhanced Host Controller #1 - 9C26, Name: Microsoft Wi-Fi Direct Virtual Adapter #4, Name: Microsoft Wi-Fi Direct Virtual Adapter #2, Name: Microsoft Radio Device Enumeration Bus, Name: Intel 8 Series PCI Express Root Port #4 - 9C16, Name: Microsoft Device Association Root Enumerator, Name: Speakers / Headphones (Realtek Audio), Name: Microsoft Input Configuration Device, Name: Intel USB 3.0 eXtensible Host Controller - 1.0 (Microsoft), Name: Intel Serial IO I2C Host Controller - 9C61, Name: Intel 8 Series Chipset Family SATA AHCI Controller, Name: Intel 8 Series PCI Express Root Port #1 - 9C10, Name: Intel 8 Series PCI Express Root Port #5 - 9C18, Name: HID-compliant vendor-defined device, Name: NDIS Virtual Network Adapter Enumerator, Name: Intel 8 Series SMBus Controller - 9C22, Name: Bluetooth Device (RFCOMM Protocol TDI), Name: Bluetooth Device (Personal Area Network) #2, Name: Microsoft System Management BIOS Driver, Name: Plug and Play Software Device Enumerator, Name: Remote Desktop Device Redirector Bus, ========================= Partitions: =====================================, 1 Drive c: () (Fixed) (Total:930.07 GB) (Free:893.73 GB) NTFS, ========================= Users: ========================================, Administrator DefaultAccount Guest, ========================= Minidump Files ==================================, ========================= Restore Points ==================================, NOTICE: This script was written specifically for this user. So you can't point to a single process as the culprit though it's possible that high demand web sites (lots of ads) trigger the problem. 2019-06-03 22:28:23, Info CSI 0000465a [SR] Verifying 100 components And other times it will bog down within an hour. 2019-06-03 22:26:31, Info CSI 00003f31 [SR] Verifying 100 components 2019-06-03 22:10:01, Info CSI 00000340 [SR] Beginning Verify and Repair transaction 2019-06-03 22:28:18, Info CSI 000045eb [SR] Verifying 100 components When we execute the standard Red Cloak Test methodology, alerts were fired off no problem. 2019-06-03 22:17:58, Info CSI 00001d4b [SR] Verifying 100 components 2019-06-03 22:17:33, Info CSI 00001c2b [SR] Beginning Verify and Repair transaction Once the cleaning process is complete, AdwCleaner will ask to restart your computer. 2019-06-03 22:24:06, Info CSI 00003537 [SR] Beginning Verify and Repair transaction In another run, after 10 hours (at the session time-out instance), the CPU usage spiked above 2000 millicores and pods started crashing. ), It is not currently known what version this logic bug was introduce in, or if it existed from the start of the Red Cloak product line. Taegis XDR ingests, enriches, and correlates data from a variety of endpoint, network, cloud and business systems. 2019-06-03 22:11:02, Info CSI 00000753 [SR] Beginning Verify and Repair transaction For more information, reference SHA-2 Code Signing Support requirement for Windows and WSUS (2019 SHA-2 Code Signing Support requirement for Windows and WSUS).2In cases where Secureworks Red Cloak Endpoint supports an operating system that is no longer supported by the operating system vendor, troubleshooting, and remediation of performance and other issues that arise may be limited. Let the scan complete. Start FRST in a similar manner to when you ran a scan earlier, but this time when it opens . A blank randomly named notepad file will open. 2019-06-03 22:17:00, Info CSI 00001a5a [SR] Verify complete 2019-06-03 22:23:11, Info CSI 000030b4 [SR] Beginning Verify and Repair transaction However, as of Windows Agent 2.0.7.9 it is confirmed to be corrected. 2019-06-03 22:20:13, Info CSI 000025c4 [SR] Verify complete I cannot imagine how that all worked though I have discussed the idea with several IT folks I know and have gotten various suggestions. The CPU usage increased and there were continuous CPU spikes at every 30 minute interval whenever the refresh token was used to acquire access tokens (30 min access token lifespan). And when the overall CPU demand goes high, then all of the "little" services increase their demand by an order of magnitude and it pushes the demand to 100%. 2019-06-03 22:10:51, Info CSI 000006eb [SR] Beginning Verify and Repair transaction 2019-06-03 22:18:34, Info CSI 00001f68 [SR] Beginning Verify and Repair transaction The file will not be moved unless listed separately. 2019-06-03 22:23:21, Info CSI 00003187 [SR] Verifying 100 components The "AlternateShell" will be restored. . What seems to happen is that something triggers high demand and then every process on the computer joins in. 2019-06-03 22:21:30, Info CSI 000029e3 [SR] Beginning Verify and Repair transaction 2019-06-03 22:19:57, Info CSI 000024ee [SR] Verifying 100 components . 2019-06-03 22:17:22, Info CSI 00001bbc [SR] Verifying 100 components I requested a CVE for this issue to help push public awareness, in addition to this blog post, but I am frankly not sure if this meets the criteria for a CVE. redcloak.exe is known as Dell SecureWorks Codename Redcloak, it also has the following name Dell SecureWorks Red Cloak or Secureworks Red Cloak and it is developed by Dell SecureWorks.We have seen about 48 different instances of redcloak.exe in different location. 2019-06-03 22:19:50, Info CSI 0000247a [SR] Beginning Verify and Repair transaction 2019-06-03 22:24:06, Info CSI 00003536 [SR] Verifying 100 components I have not been able to reproducibly create the high CPU usage problem by putting a heavy load on one application or another. by Shroobful. Here is the eSET log. Here is my log. However the CPU usageproblem remains. We have a keycloak HA setup with 3 pods running in kubernetes environment. 2019-06-03 22:19:25, Info CSI 000022c7 [SR] Beginning Verify and Repair transaction 2019-06-03 22:17:22, Info CSI 00001bbd [SR] Beginning Verify and Repair transaction 2019-06-03 22:23:21, Info CSI 00003186 [SR] Verify complete 2019-06-03 22:26:03, Info CSI 00003d34 [SR] Verify complete I downloaded the Mimikatz binary without any modifications to a unique folder on the local C:\ drive of a testing endpoint. 2019-06-03 22:12:02, Info CSI 00000a23 [SR] Verify complete step 4. 2019-06-03 22:16:24, Info CSI 000017bd [SR] Beginning Verify and Repair transaction Note: [PATH] = The full directory path to where the taegis-agent_[VERSON]_x64.msi file is located. ), HKU\S-1-5-21-2329281988-2336120714-2240144410-1001\Control Panel\Desktop\\Wallpaper -> C:\WINDOWS\web\wallpaper\Windows\img0.jpg, ==================== MSCONFIG/TASK MANAGER disabled items ==. NOTE: The 100% disk usage came back after 2 minutes but died back to 0% again. 2019-06-03 22:16:27, Info CSI 00001824 [SR] Beginning Verify and Repair transaction 2019-06-03 22:10:07, Info CSI 000003a7 [SR] Verifying 100 components ), 2017-09-29 06:46 - 2017-09-29 06:44 - 000000824 _____ C:\WINDOWS\system32\drivers\etc\hosts, (Currently there is no automatic fix for this section. 2019-06-03 22:21:06, Info CSI 00002894 [SR] Verifying 100 components 2019-06-03 22:28:06, Info CSI 0000451e [SR] Beginning Verify and Repair transaction 2019-06-03 22:25:56, Info CSI 00003ccc [SR] Verifying 100 components